102 lines
3.3 KiB
YAML
102 lines
3.3 KiB
YAML
name: ci
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- "main"
|
|
pull_request:
|
|
branches:
|
|
- "main"
|
|
|
|
env:
|
|
APP_NAME: aws-dodo
|
|
REGISTRY_URL: registry.bboysoul.cn
|
|
IMAGE_NAME: registry.bboysoul.cn/dodo
|
|
GIT_EMAIL: [email protected]
|
|
GIT_USER: bboysoul
|
|
YAML_REPO: git.bboysoul.cn/bboysoul/kubernetes-yaml
|
|
YAML_PATH: kubernetes-yaml/aws-k8s/dodo
|
|
ARGOCD_USER: admin
|
|
ARGOCD_URL: argocd.bboysoul.cn
|
|
|
|
jobs:
|
|
gitleaks:
|
|
runs-on: docker
|
|
container:
|
|
options: --user=root
|
|
steps:
|
|
- name: Check out repository history
|
|
uses: https://github.com/actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Scan Git history for secrets
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
GITLEAKS_VERSION=8.30.1
|
|
ARCHIVE="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
|
|
curl --fail --silent --show-error --location \
|
|
--output "/tmp/${ARCHIVE}" \
|
|
"https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${ARCHIVE}"
|
|
echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb /tmp/${ARCHIVE}" | sha256sum --check --strict
|
|
tar -xzf "/tmp/${ARCHIVE}" -C /usr/local/bin gitleaks
|
|
gitleaks git --redact --no-banner --verbose --log-opts="--all" .
|
|
|
|
docker:
|
|
if: gitea.event_name == 'push' && gitea.ref == 'refs/heads/main'
|
|
needs: gitleaks
|
|
runs-on: docker
|
|
container:
|
|
options: --user=root
|
|
steps:
|
|
- name: Set up Docker Buildx
|
|
uses: https://github.com/docker/setup-buildx-action@v2
|
|
|
|
- name: Login to Docker Registry
|
|
uses: https://github.com/docker/login-action@v2
|
|
with:
|
|
registry: ${{ env.REGISTRY_URL }}
|
|
username: ${{ secrets.REGISTRY_USER }}
|
|
password: ${{ secrets.REGISTRY_PASSWORD }}
|
|
|
|
- name: Build and push
|
|
uses: https://github.com/docker/build-push-action@v6
|
|
with:
|
|
push: true
|
|
tags: |
|
|
${{ env.IMAGE_NAME }}:latest
|
|
${{ env.IMAGE_NAME }}:${{ gitea.sha }}
|
|
cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
|
|
cache-to: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache,mode=max
|
|
|
|
- name: Update kustomize image
|
|
run: |
|
|
git config --global user.email "${{ env.GIT_EMAIL }}"
|
|
git config --global user.name "${{ env.GIT_USER }}"
|
|
git clone https://${{ env.GIT_USER }}:${{ secrets.CI_GIT_TOKEN }}@${{ env.YAML_REPO }}.git
|
|
cd ${{ env.YAML_PATH }}
|
|
kustomize edit set image ${{ env.IMAGE_NAME }}:${{ gitea.sha }}
|
|
git add .
|
|
git commit -m "set image ${{ env.IMAGE_NAME }}:${{ gitea.sha }}"
|
|
git push
|
|
|
|
- name: Install ArgoCD CLI
|
|
run: |
|
|
curl -sSL -o /usr/local/bin/argocd \
|
|
https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64
|
|
chmod +x /usr/local/bin/argocd
|
|
|
|
- name: ArgoCD sync
|
|
run: |
|
|
argocd login ${{ env.ARGOCD_URL }} \
|
|
--username ${{ env.ARGOCD_USER }} \
|
|
--password ${{ secrets.ARGOCD_PASSWORD }} \
|
|
--insecure \
|
|
--grpc-web
|
|
argocd app sync ${{ env.APP_NAME }} --grpc-web
|
|
argocd app wait ${{ env.APP_NAME }} \
|
|
--health \
|
|
--timeout 300 \
|
|
--grpc-web
|